Note that this is just fun and games and this post is for the hackers out there (both of these definitions of hacker...) http://en.wikipedia.org/wiki/Hacker_%28 ... culture%29 http://en.wikipedia.org/wiki/Hacker_%28hobbyist%29
It turns out these interfaces run Linux which makes them very hackable. Should be lots of good times in the future.
Note that it is very easy to damage or destroy your MDI when using these tools. Use this information and shell or u-boot access at your own risk.
The main board includes an sdcard, which includes a linux filesystem. At run time this mounts under /usr/local/. Once the filesystem is mounted you can enter bin and rename telnetd.sh-disable to telnetd.sh. Now reboot and check your MDIs IP address, and telnet in. You will be dumped straight to a root prompt. Set a nicer prompt like this:
Code: Select all
bash-3.2# export PS1='[\u@mdi \W]\$ '
[root@mdi /]#
Code: Select all
[root@mdi /]# uname -a
Linux (none) 2.6.24.4-etas-08apr25 #1 PREEMPT Tue Feb 18 16:17:00 PST 2014 armv5tel unknown
[root@mdi /]# cat /proc/cpuinfo
Processor : XScale-PXA270 rev 7 (v5l)
BogoMIPS : 517.73
Features : swp half fastmult edsp iwmmxt
CPU implementer : 0x69
CPU architecture: 5TE
CPU variant : 0x0
CPU part : 0x411
CPU revision : 7
Cache type : undefined 5
Cache clean : undefined 5
Cache lockdown : undefined 5
Cache format : Harvard
I size : 32768
I assoc : 32
I line length : 32
I sets : 32
D size : 32768
D assoc : 32
D line length : 32
D sets : 32
Hardware : KARO electronics Triton-270 on Starterkit 3
Revision : 0000
Serial : 0000000000000000
[root@mdi /]# free
total used free shared buffers
Mem: 127028 39332 87696 0 25116
Swap: 0 0 0
Total: 127028 39332 87696
What about storage?
Code: Select all
[root@mdi /]# mount
/dev/root on / type ext2 (rw)
proc on /proc type proc (rw)
sysfs on /sys type sysfs (rw)
none on /dev/pts type devpts (rw)
tmpfs on /tmp type tmpfs (rw)
/dev/mmcblk0p1 on /usr/local type ext3 (rw,noatime,data=ordered)
/dev/mmcblk0p2 on /usr/local/data type ext3 (rw,data=ordered)
Code: Select all
[root@mdi /]# cat /proc/mtd
dev: size erasesize name
mtd0: 00040000 00020000 "boot"
mtd1: 00020000 00020000 "bootvars"
mtd2: 00180000 00020000 "linux1"
mtd3: 00600000 00020000 "initrd1"
mtd4: 00180000 00020000 "linux2"
mtd5: 00600000 00020000 "initrd2"
mtd6: 00020000 00020000 "linuxvars1"
mtd7: 00020000 00020000 "linuxvars2"
mtd8: 00008000 00020000 "serialnum"
mtd9: 00008000 00020000 "macaddress"
[root@mdi bin]# /usr/local/mtd/mtd_debug info /dev/mtd1
mtd.type = MTD_NORFLASH
mtd.flags =
mtd.size = 131072 (128K)
mtd.erasesize = 131072 (128K)
mtd.oobblock = 1
mtd.oobsize = 0
mtd.ecctype = (unknown ECC type - new MTD API maybe?)
regions = 0
[root@mdi bin]# /usr/local/mtd/mtd_debug info /dev/mtd2
mtd.type = MTD_NORFLASH
mtd.flags =
mtd.size = 1572864 (1M)
mtd.erasesize = 131072 (128K)
mtd.oobblock = 1
mtd.oobsize = 0
mtd.ecctype = (unknown ECC type - new MTD API maybe?)
regions = 0
[root@mdi bin]# /usr/local/mtd/mtd_debug info /dev/mtd3
mtd.type = MTD_NORFLASH
mtd.flags =
mtd.size = 6291456 (6M)
mtd.erasesize = 131072 (128K)
mtd.oobblock = 1
mtd.oobsize = 0
mtd.ecctype = (unknown ECC type - new MTD API maybe?)
regions = 0
[root@mdi bin]# /usr/local/mtd/mtd_debug info /dev/mtd4
mtd.type = MTD_NORFLASH
mtd.flags =
mtd.size = 1572864 (1M)
mtd.erasesize = 131072 (128K)
mtd.oobblock = 1
mtd.oobsize = 0
mtd.ecctype = (unknown ECC type - new MTD API maybe?)
regions = 0
[root@mdi bin]# /usr/local/mtd/mtd_debug info /dev/mtd5
mtd.type = MTD_NORFLASH
mtd.flags =
mtd.size = 6291456 (6M)
mtd.erasesize = 131072 (128K)
mtd.oobblock = 1
mtd.oobsize = 0
mtd.ecctype = (unknown ECC type - new MTD API maybe?)
regions = 0
[root@mdi bin]# /usr/local/mtd/mtd_debug info /dev/mtd6
mtd.type = MTD_NORFLASH
mtd.flags =
mtd.size = 131072 (128K)
mtd.erasesize = 131072 (128K)
mtd.oobblock = 1
mtd.oobsize = 0
mtd.ecctype = (unknown ECC type - new MTD API maybe?)
regions = 0
[root@mdi bin]# /usr/local/mtd/mtd_debug info /dev/mtd7
mtd.type = MTD_NORFLASH
mtd.flags =
mtd.size = 131072 (128K)
mtd.erasesize = 131072 (128K)
mtd.oobblock = 1
mtd.oobsize = 0
mtd.ecctype = (unknown ECC type - new MTD API maybe?)
regions = 0
[root@mdi bin]# /usr/local/mtd/mtd_debug info /dev/mtd8
mtd.type = MTD_NORFLASH
mtd.flags =
mtd.size = 32768 (32K)
mtd.erasesize = 131072 (128K)
mtd.oobblock = 1
mtd.oobsize = 0
mtd.ecctype = (unknown ECC type - new MTD API maybe?)
regions = 0
[root@mdi bin]# /usr/local/mtd/mtd_debug info /dev/mtd9
mtd.type = MTD_NORFLASH
mtd.flags =
mtd.size = 32768 (32K)
mtd.erasesize = 131072 (128K)
mtd.oobblock = 1
mtd.oobsize = 0
mtd.ecctype = (unknown ECC type - new MTD API maybe?)
regions = 0
Code: Select all
bootargs=root=/dev/ram init=/linuxrc console=ttyS0,38400 rw ramdisk_size=24576 ip=10.103.98.238:10.103.98.205:10.103.98.129:255.255.255.128::eth0:no ethaddr=0x02:0x03:0x04:0x05:0x06:0x07 mtdparts=flash0:256k(boot),128k(bootvars),1536k(linux1),6144k(initrd1),1536k(linux2),6144k(initrd2),128k(linuxvars1),128k(linuxvars2),32k@16320k(serialnum),32k(macaddress)
baudrate=38400
board=etasvci
rev=13006
FLBLOCKSZ=128k
INITRD=0xa0a30000
autoload=no
altbootcmd=bootm linux2 initrd2
stopretry=setenv bootretry -1
loadsdargs=setenv bootargs root=/dev/ram rw ramdisk_size=24576
addinit=setenv bootargs ${bootargs} init=/linuxrc
addinitsd=setenv bootargs ${bootargs} init=/loadsdrc
addconsole=setenv bootargs ${bootargs} console=ttyS0,${baudrate}
addip=setenv bootargs ${bootargs} ip=${ipaddr}:${serverip}:${gatewayip}:${netmask}::eth0:no
addeth=setenv bootargs ${bootargs} ethaddr=${rbethaddr}
addprimary=setenv bootargs ${bootargs} bootmode=primary
addbackup=setenv bootargs ${bootargs} bootmode=backup
reprogram_uboot=tftpboot scratch u-boot/u-boot.bin.test;protect off all;erase boot;cp.b scratch boot ${filesize}
eraseenv=protect off all;erase bootvars
setbootargsloadsd=run loadsdargs addinitsd addconsole addip addeth addprimary;setenv bootargs ${bootargs} mtdparts=flash0:256k(boot),128k(bootvars),1536k(linux1),6144k(initrd1),1536k(linux2),6144k(initrd2),128k(linuxvars1),128k(linuxvars2),32k@16320k(serialnum),32k(macaddress);
setbootargsprimary=run normalargs addinit addconsole addeth addprimary;setenv bootargs ${bootargs} mtdparts=flash0:256k(boot),128k(bootvars),1536k(linux1),6144k(initrd1),1536k(linux2),6144k(initrd2),128k(linuxvars1),128k(linuxvars2),32k@16320k(serialnum),32k(macaddress);
setbootargsbackup=run normalargs addinit addconsole addeth addbackup;setenv bootargs ${bootargs} mtdparts=flash0:256k(boot),128k(bootvars),1536k(linux1),6144k(initrd1),1536k(linux2),6144k(initrd2),128k(linuxvars1),128k(linuxvars2),32k@16320k(serialnum),32k(macaddress);
setbootcmdnormal=setenv bootcmd 'run setbootargsprimary; flock; bootm linux1 initrd1 || echo Primary boot failed. Using backup boot.; run setbootargsbackup; bootm linux2 initrd2'
setbootcmdloadsd=setenv bootcmd 'run setbootargsloadsd; flock; bootm linux1 initrd1'
flash_loadsd=run setbootcmdloadsd; run bootcmd
flash_normal=run setbootcmdnormal; run bootcmd
ethaddr=00:90:7e:0d:14:13
rbethaddr=0x00:0x90:0x7e:0x0d:0x14:0x13
vcihcr=0x207
vcitype=MDI
dhcp_vendor-class-identifier=etas.vci.mdi
vcieth=SMSC9116
vcidimm=TRITON270II
serialnumber=1220-22129579
stdin=serial
stdout=serial
stderr=serial
ver=U-Boot 1.1.4 (Dec 21 2007 - 12:11:55) ETAS VCI (r13006)
serverip=192.168.222.1
buildscript=u-boot/script.mdi.u-boot
bootcmd=run setbootargsprimary; flock; bootm linux1 initrd1 || echo Primary boot failed. Using backup boot.; run setbootargsbackup; bootm linux2 initrd2
kfile1=u-boot/zImage-primary.u-boot
ksize1=134220
kfile2=u-boot/zImage-recovery.u-boot
ksize2=13421C
pfile=u-boot/initrd-primary.u-boot
psize=28903A
rfile=u-boot/initrd-recovery.u-boot
rsize=431658
filesize=431658
fileaddr=A2000000
gatewayip=192.168.222.1
netmask=255.255.255.0
ipaddr=192.168.222.144
normalargs=setenv bootargs root=/dev/ram rw ramdisk_size=24576 quiet
verify=no
bootdelay=3
Code: Select all
Jan 1 00:00:03 (none) syslogd 1.5.0: restart.
Jan 1 00:00:03 (none) kernel: net_namespace: 64 bytes
Jan 1 00:00:03 (none) kernel: NET: Registered protocol family 16
Jan 1 00:00:03 (none) kernel: CONFIG_ETAS is set
Jan 1 00:00:03 (none) kernel: 9215I byte test=0x87654321
Jan 1 00:00:03 (none) kernel: karo_read_board_type: type_found MDI
Jan 1 00:00:03 (none) kernel: karo_init: Unknown MDI type, enabling CPUCLK
Jan 1 00:00:03 (none) kernel: karo_init: hw_id: 0x0, using gpio table_index: 0
Jan 1 00:00:03 (none) kernel: Failed to verify module type; kernel configuration doesn't match HW or HW failure
Jan 1 00:00:03 (none) kernel: karo_set_features: Setting up HW features for Triton-270 (0x73)
Jan 1 00:00:03 (none) kernel: Board type is: 0x14
Jan 1 00:00:03 (none) kernel: karo_set_features: Setting up HW features for KARO Starterkit 3 (0x14)
Jan 1 00:00:03 (none) kernel: karo_mod_conf: using gpio table_index: 0
Jan 1 00:00:03 (none) kernel: karo_init: Skipping platform device[0]: karo-ide
Jan 1 00:00:03 (none) kernel: karo_init: Registering platform device[1]: smsc911x
Jan 1 00:00:03 (none) kernel: karo_init: Skipping platform device[2]: smc91x_pcmcia
Jan 1 00:00:03 (none) kernel: karo_init: Skipping platform device[3]: cs89x0
Jan 1 00:00:03 (none) kernel: usbcore: registered new interface driver usbfs
Jan 1 00:00:03 (none) kernel: usbcore: registered new interface driver hub
Jan 1 00:00:03 (none) kernel: usbcore: registered new device driver usb
Jan 1 00:00:03 (none) kernel: NET: Registered protocol family 2
Jan 1 00:00:03 (none) kernel: Time: oscr0 clocksource has been installed.
Jan 1 00:00:03 (none) kernel: IP route cache hash table entries: 1024 (order: 0, 4096 bytes)
Jan 1 00:00:03 (none) kernel: TCP established hash table entries: 4096 (order: 3, 32768 bytes)
Jan 1 00:00:03 (none) kernel: TCP bind hash table entries: 4096 (order: 2, 16384 bytes)
Jan 1 00:00:03 (none) kernel: TCP: Hash tables configured (established 4096 bind 4096)
Jan 1 00:00:03 (none) kernel: TCP reno registered
Jan 1 00:00:03 (none) kernel: Freeing initrd memory: 2810K
Jan 1 00:00:03 (none) kernel: pxa_cpufreq_init: board_id: 0xffffffff, using CPU max_freq: 520001
Jan 1 00:00:03 (none) kernel: Run Mode clock: 208.00MHz (*16)
Jan 1 00:00:03 (none) kernel: Turbo Mode clock: 520.00MHz (*2.5, active)
Jan 1 00:00:03 (none) kernel: Memory clock: 208.00MHz (/2)
Jan 1 00:00:03 (none) kernel: System bus clock: 208.00MHz
Jan 1 00:00:03 (none) kernel: PXA CPU frequency change support initialized
Jan 1 00:00:03 (none) kernel: NetWinder Floating Point Emulator V0.97 (double precision)
Jan 1 00:00:03 (none) kernel: JFFS2 version 2.2. (NAND) © 2001-2006 Red Hat, Inc.
Jan 1 00:00:03 (none) kernel: io scheduler noop registered
Jan 1 00:00:03 (none) kernel: io scheduler anticipatory registered (default)
Jan 1 00:00:03 (none) kernel: io scheduler deadline registered
Jan 1 00:00:03 (none) kernel: io scheduler cfq registered
Jan 1 00:00:04 (none) kernel: pxa2xx-uart.0: ttyS0 at MMIO 0x40100000 (irq = 22) is a FFUART
Jan 1 00:00:04 (none) kernel: console [ttyS0] enabled
Jan 1 00:00:04 (none) kernel: pxa2xx-uart.1: ttyS1 at MMIO 0x40200000 (irq = 21) is a BTUART
Jan 1 00:00:04 (none) kernel: pxa2xx-uart.2: ttyS2 at MMIO 0x40700000 (irq = 20) is a STUART
Jan 1 00:00:04 (none) kernel: RAMDISK driver initialized: 16 RAM disks of 24576K size 1024 blocksize
Jan 1 00:00:04 (none) kernel: smsc911x: Driver version 2008-06-02.
Jan 1 00:00:04 (none) kernel: eth0: SMSC911x MAC Address: 00:90:7e:0d:14:13
Jan 1 00:00:04 (none) kernel: console [netcon0] enabled
Jan 1 00:00:04 (none) kernel: netconsole: network logging started
Jan 1 00:00:04 (none) kernel: flash0: Found 1 x16 devices at 0x0 in 16-bit bank
Jan 1 00:00:04 (none) kernel: NOR chip too large to fit in mapping. Attempting to cope...
Jan 1 00:00:04 (none) kernel: Intel/Sharp Extended Query Table at 0x010A
Jan 1 00:00:04 (none) last message repeated 4 times
Jan 1 00:00:04 (none) kernel: Using buffer write method
Jan 1 00:00:04 (none) kernel: cfi_cmdset_0001: Erase suspend on write enabled
Jan 1 00:00:04 (none) kernel: Reducing visibility of 16384KiB chip to 1024KiB
Jan 1 00:00:04 (none) kernel: flash0: Found 1 x16 devices at 0x0 in 16-bit bank
Jan 1 00:00:04 (none) kernel: Intel/Sharp Extended Query Table at 0x010A
Jan 1 00:00:04 (none) last message repeated 4 times
Jan 1 00:00:04 (none) kernel: Using buffer write method
Jan 1 00:00:04 (none) kernel: cfi_cmdset_0001: Erase suspend on write enabled
Jan 1 00:00:04 (none) kernel: KARO flash: CFI device at 0x00000000, 16MiB, 16-bit
Jan 1 00:00:04 (none) kernel: 10 cmdlinepart partitions found on MTD device flash0
Jan 1 00:00:04 (none) kernel: KARO flash: using dynamic partition definition
Jan 1 00:00:04 (none) kernel: Creating 10 MTD partitions on "flash0":
Jan 1 00:00:04 (none) kernel: 0x00000000-0x00040000 : "boot"
Jan 1 00:00:04 (none) kernel: 0x00040000-0x00060000 : "bootvars"
Jan 1 00:00:04 (none) kernel: 0x00060000-0x001e0000 : "linux1"
Jan 1 00:00:04 (none) kernel: 0x001e0000-0x007e0000 : "initrd1"
Jan 1 00:00:04 (none) kernel: 0x007e0000-0x00960000 : "linux2"
Jan 1 00:00:04 (none) kernel: 0x00960000-0x00f60000 : "initrd2"
Jan 1 00:00:04 (none) kernel: 0x00f60000-0x00f80000 : "linuxvars1"
Jan 1 00:00:04 (none) kernel: 0x00f80000-0x00fa0000 : "linuxvars2"
Jan 1 00:00:04 (none) kernel: 0x00ff0000-0x00ff8000 : "serialnum"
Jan 1 00:00:04 (none) kernel: mtd: partition "serialnum" doesn't start on an erase block boundary -- force read-only
Jan 1 00:00:04 (none) kernel: 0x00ff8000-0x01000000 : "macaddress"
Jan 1 00:00:04 (none) kernel: ess" doesn't start on an erase block boundary -- force read-only
Jan 1 00:00:04 (none) kernel: mice: PS/2 mouse device common for all mice
Jan 1 00:00:04 (none) kernel: Run Mode clock: 208.00MHz (*16)
Jan 1 00:00:04 (none) kernel: Turbo Mode clock: 520.00MHz (*2.5, active)
Jan 1 00:00:04 (none) kernel: Memory clock: 208.00MHz (/2)
Jan 1 00:00:04 (none) kernel: System bus clock: 208.00MHz
Jan 1 00:00:04 (none) kernel: pxamci_probe: irq = 23
Jan 1 00:00:04 (none) kernel: karo_read_board_type: type_found MDI
Jan 1 00:00:04 (none) kernel: TCP cubic registered
Jan 1 00:00:04 (none) kernel: NET: Registered protocol family 1
Jan 1 00:00:04 (none) kernel: NET: Registered protocol family 17
Jan 1 00:00:04 (none) kernel: XScale iWMMXt coprocessor detected.
Jan 1 00:00:04 (none) kernel: karo_freq_to_voltage: Freq: 520.000(416.000..520.000)MHz, core voltage 1.450
Jan 1 00:00:04 (none) kernel: karo_pm_init: Registering core power change notifier
Jan 1 00:00:04 (none) kernel: karo_pm_init: skipping initial set_core(1450)
Jan 1 00:00:04 (none) kernel: RAMDISK: Compressed image found at block 0
Jan 1 00:00:04 (none) kernel: VFS: Mounted root (ext2 filesystem).
Jan 1 00:00:04 (none) kernel: Freeing init memory: 100K
Jan 1 00:00:04 (none) kernel: mmc0: new SD card at address c9fb
Jan 1 00:00:04 (none) kernel: mmcblk0: mmc0:c9fb SD02G 1966080KiB
Jan 1 00:00:04 (none) kernel: mmcblk0: p1 p2
Jan 1 00:00:04 (none) kernel: kjournald starting. Commit interval 5 seconds
Jan 1 00:00:04 (none) kernel: EXT3 FS on mmcblk0p1, internal journal
Jan 1 00:00:04 (none) kernel: EXT3-fs: recovery complete.
Jan 1 00:00:04 (none) kernel: EXT3-fs: mounted filesystem with ordered data mode.
Jan 1 00:00:05 (none) exiting on signal 15
Jan 1 00:00:05 (none) syslogd 1.5.0: restart.
Jan 1 00:00:05 (none) kernel: pxa27x_udc: version 01-01-2006
Jan 1 00:00:05 (none) kernel: ether gadget: using random self ethernet address
Jan 1 00:00:05 (none) kernel: ether gadget: using random host ethernet address
Jan 1 00:00:05 (none) kernel: usb0: Ethernet Gadget, version: May Day 2005
Jan 1 00:00:05 (none) kernel: usb0: using pxa27x_udc, OUT ep2out-bulk IN ep1in-bulk STATUS ep3in-intr
Jan 1 00:00:05 (none) kernel: usb0: MAC 2e:8d:70:9b:95:af
Jan 1 00:00:05 (none) kernel: usb0: HOST MAC 42:3b:92:63:d8:41
Jan 1 00:00:05 (none) kernel: usb0: RNDIS ready
Jan 1 00:00:05 (none) kernel: udc: USB reset
Jan 1 00:00:05 (none) kernel: udc: USB reset
Jan 1 00:00:05 (none) kernel: usb0: full speed config #2: 100 mA, Ethernet Gadget, using RNDIS
Jan 1 00:00:05 (none) post: POST version: 2.6
Jan 1 00:00:05 (none) post: GM MDI
Jan 1 00:00:05 (none) post: Hardware Configuration ID = 0x207
Jan 1 00:00:05 (none) post: VIO Board Rev = 7, CPU Board Rev = 2
Jan 1 00:00:05 (none) post: New DIMM, 128Mb, SMSC9116
Jan 1 00:00:05 (none) post: MDIManagerInfo FPGA: 2012/09/20, Version: 1.0.1.0
Jan 1 00:00:05 (none) post: MDIManagerInfo CAN: 2012/04/13
Jan 1 00:00:05 (none) post: MDIManagerInfo J1850: 2012/02/08
Jan 1 00:00:05 (none) post: MDIManagerInfo UART: 2012/04/20
Jan 1 00:00:07 (none) kernel: FPGA probe date 0x09202012 version 0x0fffffff
Jan 1 00:00:07 (none) kernel: etas_mux: module license 'Proprietary' taints kernel.
Jan 1 00:00:07 (none) kernel: ETAS MUX driver init
Jan 1 00:00:07 (none) kernel: mux_module_init() etas_fpga_device_register=>0
Jan 1 00:00:07 (none) kernel: MDIManagerInfo Date= 0x2b0c0400 Version= 0x2020100 Desc= Comm Port Resource Multiplexor Driver
Jan 1 00:00:07 (none) kernel: Board ID: 0x207, Exp Board ID: 0xff
Jan 1 00:00:07 (none) kernel: mux driver registered properly
Jan 1 00:00:07 (none) kernel: udc: USB reset
Jan 1 00:00:07 (none) kernel: udc: USB reset
Jan 1 00:00:07 (none) kernel: ETAS TIMER driver init
Jan 1 00:00:07 (none) kernel: MDIManagerInfo Date= 0x2b030600 Version= 0x30300 Desc= Timer Driver
Jan 1 00:00:07 (none) kernel: TIMER Driver: Major == 195, Minor == 0
Jan 1 00:00:07 (none) kernel: Vetronix TIMER Driver v0.3.3: Initialization Successful
Jan 1 00:00:07 (none) kernel: MDIManagerInfo Date= 0x2a082400 Version= 0x40000 Desc= LED Driver
Jan 1 00:00:07 (none) kernel: ETAS LED Driver:led_driver_probe
Jan 1 00:00:07 (none) kernel: Major#==198 Minor#==0
Jan 1 00:00:07 (none) kernel: ETAS LED Driver v0.4.0 LOADED
Jan 1 00:00:07 (none) kernel: led driver registered properly
Jan 1 00:00:07 (none) kernel: MDIManagerInfo Date= 0x2a030e00 Version= 0x30300 Desc= Speaker Driver
Jan 1 00:00:07 (none) kernel: ETAS SPEAKER Driver:speaker_driver_probe
Jan 1 00:00:07 (none) kernel: Major#==199 Minor#==0
Jan 1 00:00:07 (none) kernel: ETAS SPEAKER Driver v0.3.1 LOADED
Jan 1 00:00:07 (none) kernel: speaker driver registered properly
Jan 1 00:00:08 (none) kernel: udc: USB reset
Jan 1 00:00:08 (none) last message repeated 3 times
Jan 1 00:00:08 (none) kernel: usb0: full speed config #2: 100 mA, Ethernet Gadget, using RNDIS
Jan 1 00:00:08 (none) kernel: kjournald starting. Commit interval 5 seconds
Jan 1 00:00:08 (none) kernel: EXT3 FS on mmcblk0p2, internal journal
Jan 1 00:00:08 (none) kernel: EXT3-fs: recovery complete.
Jan 1 00:00:08 (none) kernel: EXT3-fs: mounted filesystem with ordered data mode.
Jan 1 00:00:10 (none) kernel: eth0: SMSC911x/921x identified at 0xc8860000, IRQ: 116
Jan 1 00:00:10 (none) kernel: eth0: link down
Jan 1 00:00:11 (none) kernel: ETAS Status Driver version v7.0.0 - date 08/20/2008
Jan 1 00:00:11 (none) kernel: MDIManagerInfo Date= 0x2b060e00 Version= 0x1000600 Desc= J1850 Controller Driver
Jan 1 00:00:11 (none) kernel: J1850 Controller Driver: Major == 196, Minor == 0
Jan 1 00:00:11 (none) kernel: insert_resource fpga-j1850: start: 0x10000400, end: 0x1000041f
Jan 1 00:00:11 (none) kernel: insert_resource fpga-j1850: start: 0xa1, end: 0xa1
Jan 1 00:00:11 (none) kernel: Vetronix J1850 Controller Driver v1.0.6: Initialization Successful
Jan 1 00:00:11 (none) kernel: sja: banner_(78)
Jan 1 00:00:11 (none) kernel: sja: banner_(80)
Jan 1 00:00:11 (none) kernel: sja: +on_init(): vers: fpga:[9/20/2012 0x0ffff #fff]
Jan 1 00:00:11 (none) kernel: MDIManagerInfo Date= 0x2b091e00 Version= 0x80400 Desc= SJA CAN Driver
Jan 1 00:00:11 (none) kernel: .info@c7ca3eb4 .std.id@c7ca3eb5 .std.data@c7ca3eb7
Jan 1 00:00:11 (none) kernel: # CAN controllers = 3
Jan 1 00:00:11 (none) kernel: insert_resource sja1000.0: start: 0x10000100, end: 0x100001ff
Jan 1 00:00:11 (none) kernel: insert_resource sja1000.0: start: 0x9d, end: 0x9d
Jan 1 00:00:11 (none) kernel: insert_resource sja1000.1: start: 0x10000200, end: 0x100002ff
Jan 1 00:00:11 (none) kernel: insert_resource sja1000.1: start: 0x9e, end: 0x9e
Jan 1 00:00:11 (none) kernel: insert_resource sja1000.2: start: 0x10000300, end: 0x100003ff
Jan 1 00:00:11 (none) kernel: insert_resource sja1000.2: start: 0x9f, end: 0x9f
Jan 1 00:00:11 (none) kernel: DAC Driver: Major == 193, Minor == 0
Jan 1 00:00:11 (none) kernel: MDIManagerInfo Date= 0x2a090400 Version= 0x30100 Desc= Analog to Digital Converter Driver
Jan 1 00:00:11 (none) kernel: Vetronix DAC Driver v0.3.1 Date: 9/04/2012: Initialization Successful
Jan 1 00:00:12 (none) kernel: UART Protocol driver init
Jan 1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= UART Protocol Driver
Jan 1 00:00:12 (none) kernel: KWU UART line discipline version
Jan 1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW UART LINE DISCIPLINE Driver
Jan 1 00:00:12 (none) kernel: KWU UART line discipline version
Jan 1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW UART LINE DISCIPLINE Driver
Jan 1 00:00:12 (none) kernel: KWU UART line discipline version
Jan 1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW UART LINE DISCIPLINE Driver
Jan 1 00:00:12 (none) kernel: KWU UART line discipline version
Jan 1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW UART LINE DISCIPLINE Driver
Jan 1 00:00:12 (none) kernel: KW71 UART line discipline version
Jan 1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW71 UART LINE DISCIPLINE Driver
Jan 1 00:00:12 (none) kernel: KWU UART line discipline version
Jan 1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW UART LINE DISCIPLINE Driver
Jan 1 00:00:12 (none) kernel: KWU UART line discipline version
Jan 1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW UART LINE DISCIPLINE Driver
Jan 1 00:00:12 (none) kernel: KWU UART line discipline version
Jan 1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW UART LINE DISCIPLINE Driver
Jan 1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2a011200 Version= 0x40300 Desc= UART Protocol Driver J2740 Line Discipline
Jan 1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0e00 Version= 0x40500 Desc= UART Protocol Driver J1708 Line Discipline
Jan 1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x26091d00 Version= 0x1000 Desc= UART Protocol Driver SUBARU Start-Stop Line Discipline
Jan 1 00:00:12 (none) kernel: UBP UART line discipline version
Jan 1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x29041500 Version= 0x40400 Desc= UBP UART LINE DISCIPLINE Driver
Jan 1 00:00:12 (none) kernel: SCI UART line discipline version
Jan 1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x29030e00 Version= 0x40000 Desc= SCI UART LINE DISCIPLINE Driver
Jan 1 00:00:12 (none) kernel: UART logger line discipline version
Jan 1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x29030e00 Version= 0x40000 Desc= UART LOGGER LINE DISCIPLINE Driver
Jan 1 00:00:12 (none) kernel: KWU UART line discipline version
Jan 1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW UART LINE DISCIPLINE Driver
Jan 1 00:00:12 (none) kernel: KWU UART line discipline version
Jan 1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW UART LINE DISCIPLINE Driver
Jan 1 00:00:12 (none) kernel: KW71 UART line discipline version
Jan 1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW71 UART LINE DISCIPLINE Driver
Jan 1 00:00:12 (none) kernel: KWU UART line discipline version
Jan 1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW UART LINE DISCIPLINE Driver
Jan 1 00:00:12 (none) kernel: KW71 UART line discipline version
Jan 1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW71 UART LINE DISCIPLINE Driver
Jan 1 00:00:12 (none) kernel: KWU UART line discipline version
Jan 1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW UART LINE DISCIPLINE Driver
Jan 1 00:00:12 (none) kernel: KWU UART line discipline version
Jan 1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW UART LINE DISCIPLINE Driver
Jan 1 00:00:12 (none) kernel: KWU UART line discipline version
Jan 1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW UART LINE DISCIPLINE Driver
Jan 1 00:00:12 (none) kernel: KWU UART line discipline version
Jan 1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW UART LINE DISCIPLINE Driver
Jan 1 00:00:12 (none) kernel: KW71 UART line discipline version
Jan 1 00:00:12 (none) kernel: MDIManagerInfo Date= 0x2b0a0a00 Version= 0x40500 Desc= KW71 UART LINE DISCIPLINE Driver
Jan 1 00:00:12 (none) kernel: Version Info Date= 0x29080100 Version= 0x40000 Desc= UART Protocol Driver FPGA Interface
Jan 1 00:00:12 (none) kernel: insert_resource fpga-uart.0: start: 0x10000080, end: 0x100000bf
Jan 1 00:00:12 (none) kernel: insert_resource fpga-uart.0: start: 0x49, end: 0x49
Jan 1 00:00:12 (none) kernel: insert_resource fpga-uart.1: start: 0x100000c0, end: 0x100000ff
Jan 1 00:00:12 (none) kernel: insert_resource fpga-uart.1: start: 0xaa, end: 0xaa
Jan 1 00:00:12 (none) kernel: ETAS FPGA UART Driver version 0.4.0: Initialization successful.
Jan 1 00:00:12 (none) kernel: Vetronix FPGA Input Capture Driver v0.0.2.2: Initialization Successful
Jan 1 00:00:12 (none) kernel: eth0: link up, 100Mbps, full-duplex, lpa 0x85E1
Jan 1 00:00:16 (none) linuxrc: Starting pid 997, console /dev/ttyS0: '/sbin/getty'
So, lets go deeper. Its got U-Boot, and I want in. I managed to trace the data across the board, and find it on the mini din 8 connector on the outside of the case labeled "RS232 (for future use)". I guess this means they can reflash it from factory without opening the case. I tested with the scope and found tx and rx pins. You can make up a connector from your pc connecting to these pins:
Once done, set your terminal app to 38400,8,n,1 and click reset.
Code: Select all
U-Boot 1.1.4 (Dec 21 2007 - 12:11:55) ETAS VCI (r13006)
U-Boot code: A3F00000 -> A3F218F0 BSS: -> A3F27524
RAM Configuration: TRITON 270 II
Bank #0: a0000000 64 MB
Bank #1: a4000000 64 MB
HW Configuration: (0x207) MDI VCI with SMSC9116
Found P30 Flash, unlocking all blocks: 130
Flash: 16 MB
In: serial
Out: serial
Err: serial
Hit any key to stop autoboot: 0
$
$
$ help
? - alias for 'help'
askenv - get environment variables from stdin
autoscr - run script from memory
base - print or set address offset
bdinfo - print Board Info structure
boot - boot default, i.e., run 'bootcmd'
bootd - boot default, i.e., run 'bootcmd'
bootm - boot application image from memory
bootp - boot image via network using BootP/TFTP protocol
cmp - memory compare
coninfo - print console devices and information
cp - memory copy
crc32 - checksum calculation
dhcp - invoke DHCP client to obtain IP/boot params
echo - echo args to console
erase - erase FLASH memory
exit - exit script
flinfo - print FLASH memory information
flock - physical lock of Strataflash
funlock - physical unlock of Strataflash
go - start application at address 'addr'
help - print online help
iminfo - print header information for application image
imls - list all images found in flash
increnv - increment environment variables
itest - return true/false on integer compare
loadb - load binary file over serial line (kermit mode)
loads - load S-Record file over serial line
loop - infinite loop on address range
macaddr - display or store MAC address in Strataflash
mapadd - add a memory map item
mapdel - delete a memory map item
mapinfo - display the memory map information
md - memory display
mm - memory modify (auto-incrementing)
mmcinfo - get info on mmc(sd) card
mtest - simple RAM test
mw - memory write (fill)
nfs - boot image via network using NFS protocol
nm - memory modify (constant address)
ping - send ICMP ECHO_REQUEST to network host
pinit - PCMCIA sub-system
printenv- print environment variables
protect - enable or disable FLASH write protection
rarpboot- boot image via network using RARP/TFTP protocol
reset - Perform RESET of the CPU
run - run commands in an environment variable
saveenv - save environment variables to persistent storage
setenv - set environment variables
sleep - delay execution for some time
test - minimal test like /bin/sh
tftpboot- boot image via network using TFTP protocol
version - print monitor version
$ bdinfo
arch_number = 0x000000BE
env_t = 0x00000000
boot_params = 0xA0001000
DRAM bank = 0x00000000
-> start = 0xA0000000
-> size = 0x04000000
DRAM bank = 0x00000001
-> start = 0xA4000000
-> size = 0x04000000
ethaddr = 00:90:7E:0D:14:13
ip_addr = 10.103.98.238
baudrate = 38400 bps
$ flinfo
Bank # 1: CFI conformant FLASH (16 x 16) Size: 16 MB in 131 Sectors
Erase timeout 4096 ms, write timeout 0 ms, buffer write timeout 1024 ms, buffer size 64
Sector Start Addresses:
00000000 (RO) 00008000 (RO) 00010000 (RO) 00018000 (RO) 00020000 (RO)
00040000 (RO) 00060000 00080000 000A0000 000C0000
000E0000 00100000 00120000 00140000 00160000
00180000 001A0000 001C0000 001E0000 00200000
00220000 00240000 00260000 00280000 002A0000
002C0000 002E0000 00300000 00320000 00340000
00360000 00380000 003A0000 003C0000 003E0000
00400000 00420000 00440000 00460000 00480000
004A0000 004C0000 004E0000 00500000 00520000
00540000 00560000 00580000 005A0000 005C0000
005E0000 00600000 00620000 00640000 00660000
00680000 006A0000 006C0000 006E0000 00700000
00720000 00740000 00760000 00780000 007A0000
007C0000 007E0000 00800000 00820000 00840000
00860000 00880000 008A0000 008C0000 008E0000
00900000 00920000 00940000 00960000 00980000
009A0000 009C0000 009E0000 00A00000 00A20000
00A40000 00A60000 00A80000 00AA0000 00AC0000
00AE0000 00B00000 00B20000 00B40000 00B60000
00B80000 00BA0000 00BC0000 00BE0000 00C00000
00C20000 00C40000 00C60000 00C80000 00CA0000
00CC0000 00CE0000 00D00000 00D20000 00D40000
00D60000 00D80000 00DA0000 00DC0000 00DE0000
00E00000 00E20000 00E40000 00E60000 00E80000
00EA0000 00EC0000 00EE0000 00F00000 00F20000
00F40000 00F60000 00F80000 00FA0000 00FC0000
00FE0000